Nagios Support Forum

HI,

I've been asked some questions on the Windows agent for Nagios XI (we currently run 5.3.3 and will be upgrading this week to 5.4.x the latest).

1) What is the difference in fuctionality of Agent versus Agentless Windows agent?
2) For the agentless and agentwhat protocol and how does Nagios talk to the Windows workstation/server with each?
3) Are there 32 bit and 64 bit versions or is there one agent version that will work on 2008/2012/Win7/Win10? If not how many agents do I need to cover that range?
4) What is best practice for monitoring Windows servers? Agent vs Agentless and why?
5) Any security issues (more or less or known vulnerabilities) with Agentless versus Agent?
6) What ports are needed for both Agent versus Agentless?

1) What is the difference in fuctionality of Agent versus Agentless Windows agent?

Agent will allow a lot more control than agentless. Agentless with Windows is just WMI, so whatever metrics are available through this interface restrict what WMI can do. An agent has access to quite a bit more, including the ability to execute local scripts on the Windows machines.

2) For the agentless and agentwhat protocol and how does Nagios talk to the Windows workstation/server with each?

Agentless = WMI - https://assets.nagios.com/downloads/nag ... ios-XI.pdf
Agent = either NCPA, or NSClient++ (both are agents - NCPA is developed by us, and has quite a bit of functionality. https://nagios.org/ncpa)

3) Are there 32 bit and 64 bit versions or is there one agent version that will work on 2008/2012/Win7/Win10? If not how many agents do I need to cover that range?

You will need the 32 or 64 bit for NSClient++, and for NCPA it appears a 32-bit fits all.

4) What is best practice for monitoring Windows servers? Agent vs Agentless and why?

See #1 for comparison - if you go the NSClient++ route, I would use NRPE instead of check_nt. Perhaps build the installer in with your image, or silent installer, depending on how you manage your applications.

5) Any security issues (more or less or known vulnerabilities) with Agentless versus Agent?

Most vulns are patched up at this point. Really not much difference on this realm.
WMI = 135 (I think, based on what Google says. subsequent convo takes place on a randomly assigned port after initial call)
NSClient++ = NRPE - 5666, check_nt - 12489
NCPA = 5693

Just checking in since we have not heard from you in a while. Did @rkennedy's post clear things up?

Yes. Good information.

Thank you,

Tom

I'll be closing this thread now, but feel free to open another if you need anything in the future!